http4k information exposure via improper cookie scoping in BasicCookieStorage

Severity: medium · CVSS 6.9 · Published 2026-06-19

A vulnerability in the http4k library's cookie storage component could allow sensitive information to leak between different websites. If an application uses the same cookie storage to communicate with multiple services, it may inadvertently send private login tokens or session data to the wrong destination. This could also result in secure cookies being sent over unencrypted connections, potentially exposing them to interception.

Technologies: Http4k-Core. Vendors: Http4k.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.9, published 19 June 2026.
Which products and versions are affected?
Http4k-Core < 6.48.0.0, < 5.42.0.0, < 4.51.0.0.
Is there a fix for This vulnerability?
A patch was published on 2026-05-26: Initial fix commit in repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Http4k-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The `BasicCookieStorage` implementation in http4k (now renamed `InsecureCookieStorage`) failed to enforce RFC 6265 scoping rules. Specifically, it did not validate cookie domain, path, or the `Secure` attribute when retrieving cookies for a request. An attacker could potentially receive cookies intended for a different domain if a client uses a single storage instance for multiple origins. Additionally, cookies marked as `Secure` could be transmitted over plain HTTP. The issue is resolved by the introduction of `DefaultCookieStorage`, which is RFC 6265 compliant and now serves as the default implementation.

Affected products

  • http4k http4k-core < 6.48.0.0, < 5.42.0.0, < 4.51.0.0

Timeline

  • 2026-05-26: patched: Initial fix commit in repository
  • 2026-06-16: disclosed: Advisory published by maintainers
  • 2026-06-19: advisory: GitHub Advisory reviewed and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.